Filtering Security Controls

ABSTRACT

Methods, apparatus, and processor-readable storage media for filtering security controls are provided herein. An example computer-implemented method includes obtaining information pertaining to a software project and a target market of the software project; and identifying, based on the obtained information, at least one security control to be implemented in the software project, from among a plurality of security controls, in order to satisfy at least a threshold level of security defined for the software project, wherein the threshold level of security is based at least in part on one or more security standards related to the target market.

FIELD

The field relates generally to information processing systems, and moreparticularly to techniques for providing security in such systems.

BACKGROUND

There is a growing number of security and privacy standards. Someaspects of these standards include significant overlap, while otheraspects are relevant to particular technology and/or market contexts. Itis often difficult to determine which security standards are applicableto a given software project. For new software projects, accounting forall of the security requirements upfront can hinder an ability of adevelopment team to rapidly deliver software (often referred to as“analysis paralysis”). Additionally, security requirements are oftendeferred due to the cost and complexity involved with implementing them,and thus security becomes an afterthought rather than built into thesoftware at the outset.

A need exists for improved techniques to tailor security controls for agiven software product based on relevant characteristics associated withthe given software product.

SUMMARY

Illustrative embodiments of the disclosure provide techniques forfiltering security controls. An exemplary method includes obtaininginformation pertaining to a software project and a target market of thesoftware project; and identifying, based on the obtained information, atleast one security control to be implemented in the software project,from among a plurality of security controls, in order to satisfy atleast a threshold level of security defined for the software project,wherein the threshold level of security is based at least in part on oneor more security standards related to the target market.

Illustrative embodiments can provide significant advantages relative toconventional techniques for implementing security controls. For example,challenges associated with identifying and implementing the propersecurity requirements for a given software product are overcome by, forexample, mapping security requirements to normalized security controlsand filtering the normalized security controls based on relevantcharacteristics associated with the given software product (such as, forexample, a target market and possibly one or more additionalcharacteristics, such as an assurance level needed). This allows, forexample, security controls to be more efficiently identified,implemented, and verified given the current parameters of the softwaredevelopment project, thereby improving the overall security of thesystem.

These and other illustrative embodiments described herein include,without limitation, methods, apparatus, systems, and computer programproducts comprising processor-readable storage media.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an information processing system configured for filteringsecurity controls in an illustrative embodiment.

FIG. 2 shows a non-limiting example of input for filtering securitycontrols in accordance with an illustrative embodiment

FIG. 3 shows another non-limiting example of input that can be used forfiltering security controls in accordance with an illustrativeembodiment.

FIG. 4 is a flow diagram of a process for filtering security controls inan illustrative embodiment.

FIGS. 5 and 6 show examples of processing platforms that may be utilizedto implement at least a portion of an information processing system inillustrative embodiments.

DETAILED DESCRIPTION

Illustrative embodiments will be described herein with reference toexemplary computer networks and associated computers, servers, networkdevices or other types of processing devices. It is to be appreciated,however, that these and other embodiments are not restricted to use withthe particular illustrative network and device configurations shown.Accordingly, the term “computer network” as used herein is intended tobe broadly construed, so as to encompass, for example, any systemcomprising multiple networked processing devices.

FIG. 1 shows a computer network (also referred to herein as aninformation processing system) 100 configured in accordance with anillustrative embodiment. The computer network 100 comprises a pluralityof user devices 102-1, 102-2, . . . 102-K, collectively referred toherein as user devices 102. The user devices 102 are coupled to anetwork 104, where the network 104 in this embodiment is assumed torepresent a sub-network or other related portion of the larger computernetwork 100. Accordingly, elements 100 and 104 are both referred toherein as examples of “networks” but the latter is assumed to be acomponent of the former in the context of the FIG. 1 embodiment. Alsocoupled to network 104 is a security controls filtering system 105.

The user devices 102 may comprise, for example, mobile telephones,laptop computers, tablet computers, desktop computers or other types ofcomputing devices. Such devices are examples of what are more generallyreferred to herein as “processing devices.” Some of these processingdevices are also generally referred to herein as “computers.” The userdevices 102 may include any suitable means for performing Human ComputerInteraction.

The user devices 102 in some embodiments comprise respective computersassociated with a particular company, organization or other enterprise.In addition, at least portions of the computer network 100 may also bereferred to herein as collectively comprising an “enterprise network.”Numerous other operating scenarios involving a wide variety of differenttypes and arrangements of processing devices and networks are possible,as will be appreciated by those skilled in the art.

Also, it is to be appreciated that the term “user” in this context andelsewhere herein is intended to be broadly construed so as to encompass,for example, human, hardware, software or firmware entities, as well asvarious combinations of such entities.

The network 104 is assumed to comprise a portion of a global computernetwork such as the Internet, although other types of networks can bepart of the computer network 100, including a wide area network (WAN), alocal area network (LAN), a satellite network, a telephone or cablenetwork, a cellular network, an ad hoc network, a point-to-point (P2P)protocol network, a wireless network such as a Wi-Fi or WiMAX network,or various portions or combinations of these and other types ofnetworks. The computer network 100 in some embodiments thereforecomprises combinations of multiple different types of networks, eachcomprising processing devices configured to communicate using internetprotocol (IP) or other related communication protocols.

Additionally, the security controls filtering system 105 can have anassociated database 106 configured to store data 107 pertaining tosecurity controls, which comprise, for example, applicability criteria,verification methods, and/or guidance related to the security controls(such as, for example, code snippets and/or libraries).

The database 106 in the present embodiment is implemented using one ormore storage systems associated with the security controls filteringsystem 105. Such storage systems can comprise any of a variety ofdifferent types of storage including network-attached storage (NAS),storage area networks (SANs), direct-attached storage (DAS) anddistributed DAS, as well as combinations of these and other storagetypes, including software-defined storage.

Also associated with the security controls filtering system 105 areinput-output devices 108, which illustratively comprise keyboards,displays or other types of input-output devices in any combination. Suchinput-output devices can be used, for example, to support one or moreuser interfaces to the security controls filtering system 105, as wellas to support communication between user devices 102, the securitycontrols filtering system 105, and other related systems and devices notexplicitly shown.

The security controls filtering system 105 in the FIG. 1 embodiment isassumed to be implemented using at least one processing device. Eachsuch processing device generally comprises at least one processor and anassociated memory, and implements one or more functional modules forcontrolling certain features of the security controls filtering system105.

More particularly, the security controls filtering system 105 in thisembodiment can comprise a processor 120 coupled to a memory 122 and anetwork interface 124.

The processor 120 illustratively comprises a microprocessor, amicrocontroller, an application-specific integrated circuit (ASIC), afield-programmable gate array (FPGA) or other type of processingcircuitry, as well as portions or combinations of such circuitryelements.

The memory 122 illustratively comprises random access memory (RAM),read-only memory (ROM) or other types of memory, in any combination. Thememory 122 and other memories disclosed herein may be viewed as examplesof what are more generally referred to as “processor-readable storagemedia” storing executable computer program code or other types ofsoftware programs.

One or more embodiments include articles of manufacture, such ascomputer-readable storage media. Examples of an article of manufactureinclude, without limitation, a storage device such as a storage disk, astorage array or an integrated circuit containing memory, as well as awide variety of other types of computer program products. The term“article of manufacture” as used herein should be understood to excludetransitory, propagating signals.

The network interface 124 allows the security controls filtering system105 to communicate over the network 104 with the user devices 102, andillustratively comprises one or more conventional transceivers.

The processor 120 further comprises an application profiler 130, asecurity controls filter 132, and an information generator 134.

It is to be appreciated that this particular arrangement of modules 130,132, and 134 illustrated in the processor 120 of the FIG. 1 embodimentis presented by way of example only, and alternative arrangements can beused in other embodiments. For example, the functionality associatedwith the modules 130, 132, and 134 in other embodiments can be combinedinto a single module, or separated across a larger number of modules. Asanother example, multiple distinct processors can be used to implementdifferent ones of the modules 130, 132, and 134 or portions thereof.

At least portions of the application profiler 130, the security controlsfilter 132, and the information generator 1344 may be implemented atleast in part in the form of software that is stored in memory 122 andexecuted by processor 120.

It is to be understood that the particular set of elements shown in FIG.1 for automated threat analysis of a system design involving securitycontrols filtering system 105 and user devices 102 of computer network100 is presented by way of illustrative example only, and in otherembodiments additional or alternative elements may be used. Thus,another embodiment includes additional or alternative systems, devicesand other network entities, as well as different arrangements of modulesand other components.

An exemplary process utilizing an application profiler 130, a securitycontrols filter 132, and an information generator 134 of the securitycontrols filtering system 105 in computer network 100 will be describedin more detail with reference to the flow diagram of FIG. 4.

As noted herein, there is a plethora of security and privacy standards(such as, for example, ISO 27002 (IT Security), 27040 (StorageSecurity), Payment Card Industry (PCI), OWASP (Open Web ApplicationSecurity Project) Top 10, SANS Top 25, HIPPA (Health InsurancePortability and Accountability Act), SOX (Sarbanes-Oxley Act), FIPS(Federal Information Processing Standards), and NIST (National Instituteof Standards and Technology) 800 series). Understanding which standardsto apply to a given product can be a time-consuming analysis process.Some of the requirements have been captured in FTC (Federal TradeCommission) case studies where vendors have been fined for not meetingbasic security requirements.

The security requirements are so numerous and complex that a manualanalysis by a subject matter expert is often needed to identifytradeoffs (such as, for example, between implementing core functionalityand implementing security controls) in order to determine a minimumviable product. By way of example, it is often not wise to implementadvanced security functionality at the cost of core functionality fornew products (such as an initial version of a software product). In suchsituations, the core functionality typically needs to be released andrefined as soon as possible, otherwise the product is unlikely tosucceed. On the other hand, a mature product that is sold into aregulated environment (e.g., PCI) will face stringent control objectivesthat must be implemented to be considered during the purchase process.

At least one embodiment of the disclosure includes tailoring securitycontrols based on a target market and an assurance level for a piece ofsoftware to help address the numerous definitions of security. Someexample embodiments include obtaining characteristics of a piece ofsoftware and identifying security controls that are needed to secure thesoftware based on the target market and possibly one or more additionalcharacteristics, such as an assurance level. It is noted that the term“security control” as used herein is intended to be broadly construed soas to encompass, for example, any mechanism that mitigates against athreat.

According to some example embodiments, a security control catalog isused to map various different standards to normalized security controls.By way of example, the mapping in the security control catalog may bedefined manually (e.g., an expert manually reviewing different standardsand mapping sections of the standards to the normalized securitycontrols), in an automated manner (e.g., a software script that crawlstext of various standards to identify overlapping sections), in asemi-automated manner (e.g., using a software script to identifyoverlapping sections along with user verification of the identifiedsections), or a combination thereof. This mapping allows overlappingrequirements to be removed, thus providing a single set of requirementsfor product developers to reference. For each security control, anapplicability criterion is maintained. The applicability criterion maybe a Boolean logic of: (1) the technological characteristics of thesoftware that trigger the security control, and (2) the market and/orregulatory context in which the security control is required. As anexample, a security control related to network filtering is onlyapplicable to software that communicates over a network. As anotherexample, cryptography controls may be different for different countries.Each security control is a verifiable requirement, wherein the level ofverification performed specifies the assurance level. For example, asecurity control may be verified through self-attestation by a developer(which is low cost but also low assurance) or through independentwhite-box verification by an expert (which is higher cost but alsohigher assurance). With such a structure, a user (e.g., a productmanager, architect or developer) may determine the security controlsnecessary for a given piece of software by providing characteristics onthe target market and/or technological characteristics of a piece ofsoftware.

Referring now to FIG. 2, this figure shows a non-limiting example ofinput that can be used for filtering security controls in accordancewith an illustrative embodiment. In this example, the input is in theform of user input provided in response to a questionnaire output to auser interface 200. It is noted that the questionnaire shown in FIG. 2is not intended to be limiting, and other formats are also possible(e.g., multiple choice format, all text format, etc.). Additionally, itis to be appreciated that the specific questions shown in FIG. 2 aremerely examples, and that characteristics associated with theapplication may be obtained in different ways such as using a differentset of questions (for example, fewer questions, more questions, ordifferent questions).

In case of input provided in the form depicted in FIG. 2, a list of thenecessary controls and verifications along with implementation andverification effort estimates may be generated. The user can then filterthe security controls list by specifying a target market (if one is notalready specified) and an assurance level to compare and determine theproper security scope given, for example, resource availability.According to some example embodiments, a target market may be impliedand/or determined based on the software code itself. As an example, ifsoftware includes portions of code related to processing credit cardpayments, then a PCI target market may be identified based on thoseportions. The user may then change the target market if it isinaccurate, or add additional target markets, for example.

Referring now to FIG. 3, this figure shows another example of input thatcan be used for filtering security controls in accordance with anillustrative embodiment. In this example, the input is in the form of adesign 300 of a system architecture. The design 300 shows variouselements of the system architecture including a web application 315, adaemon 320, an AuthN (authentication) service 325, and a data store 335that stores local user data and passwords. The design 300 also shows auser 305 and an admin 310 that interact with the web application 315.The arrows in the design 300 indicate data flows between the variouselements. The design 300 represents, for example, at least a part ofinput that can be provided to the security controls filtering system105.

In some example embodiments, if input is provided in the form of asystem design (such as, for example, design 300), then security controlsmay be automatically placed within the system design (such as describedin U.S. application Ser. No. 16/530,437, which is incorporated byreference herein in its entirety). Additionally, the security controlswithin the system design may be dynamically updated to match the levelof security required by the user. The amount effort required toimplement the security controls may be estimated (e.g., based on theamount of complexity involved) and output to the user along with, forexample, verification methods, and any relevant guidance (e.g., codesnippets and libraries).

In this manner, an exemplary embodiment allows an initial set ofsecurity protocols that is needed to secure a software design to beoutput to a user interface, and then this set of security protocols maybe dynamically updated in response to a user adjusting the assurancelevel and/or target market within the user interface. As an example, aset of assurance levels may include:

-   -   Compliant Level: A minimum amount security that a product has to        implement to avoid liability.    -   Standard Practice: A level of security equal to the standard        practice in the industry (e.g., a level required by customers to        be competitive in the market).    -   Leading Practice: A level of security that goes beyond customer        expectations and provides a superior security experience.    -   Cutting Edge: A level of security that is more nascent and        experimental in nature, going beyond leading practice.

Also, in least some example embodiments, a normalized security controlmay include information pertaining to, for example, the applicationcriteria, verification information (such as the verification methodsneeded to achieve a certain assurance level), and references to relevantsecurity standards. For example, a normalized security control forpreventing SQL injection vulnerabilities may include the followinginformation:

-   -   1) Security Control Description: Any code that interacts with a        SQL database must be defensively coded to prevent SQL injection        vulnerabilities (for example).    -   2) Applicability Criteria: any code that interacts with a SQL        database.    -   3) Verification Methods:        -   a) Low Assurance: developer attests that parameterized            prepared statements (or another safe method) are used            throughout the codebase.        -   b) Medium Assurance: a static analysis tool verifies that            there are no unsafe SQL interactions in the codebase.        -   c) Higher Assurance: an independent verification is            performed on the software and no SQL injection            vulnerabilities are discovered.    -   4) References: OWASP Top 10 A1, CWE-89 (Part of SANS Top 25,        referenced above), PCI Software Security Standard.

FIG. 4 is a flow diagram of a process for filtering security controls inan illustrative embodiment. It is to be understood that this particularprocess is only an example, and additional or alternative processes canbe carried out in other embodiments.

In this embodiment, the process includes steps 402 through 410, whereinsteps 406 through 410, shown in dashed outline, are optional. Thesesteps are assumed to be performed by the processor 120 utilizing itsmodules 130, 132, and/or 134. Such references herein to optional stepsor elements should not be construed that other steps or elements arerequired in other embodiments.

Step 402 includes obtaining information pertaining to a software projectand a target market of the software project. Step 404 includesidentifying, based on the obtained information, at least one securitycontrol to be implemented in the software project, from among aplurality of security controls, in order to satisfy at least a thresholdlevel of security defined for the software project, wherein thethreshold level of security is based at least in part on one or moresecurity standards related to the target market. Step 406 includesoutputting an indication of the identified security controls. Theindication may be output to, for example, a user interface. Step 408includes dynamically updating the indication in response to a change inthe threshold level of security and/or the target market. The change maybe, for example, based on user input obtained in response to outputtingthe indication of the identified security controls. Step 410 includesperforming one or more remediation actions based on the output. Forexample, the one or more remediation actions may include automaticallyimplementing the at least one identified security control in thesoftware project.

The information obtained in step 402 may correspond to user inputprovided in response to one or more application profiling questionsprovided on a graphical user interface. The information obtained in step402 may include a software design representation of the software projectthat indicates at least one of: one or more processes of the softwareproject, one or more dataflows within the software project, a type ofeach of the dataflows, one or more existing security controls, and oneor more storage data locations. The at least one security control may bemapped to a plurality of security standards to remove overlappingsecurity requirements defined in the plurality of security standards.

The process in FIG. 4 may include a step of maintaining one or moreapplication criteria for each of the plurality of security controls,wherein the application criteria defines software characteristics thattrigger a corresponding one of the security controls and a context inwhich the corresponding security control is required. Identifying the atleast one security control in step 402 may be based at least in part onthe application criteria that is maintained for each of the plurality ofsecurity controls.

The process in FIG. 4 may include a step of maintaining, for a given oneof the security controls, a plurality of verification methods, whereinthe verification methods verify whether the given security controlsatisfies different levels of security defined for the software project,and providing information indicative of the identified at least onesecurity control and at least one verification method corresponding tothe identified at least one security control that corresponds to thethreshold level of security defined for the software project. Thethreshold level of security may be configurable based on user input. Theplurality of verification methods for the given security control mayinclude one or more of: a self-attestation method; an automated staticanalysis method; and an expert-verification method. The process in FIG.4 may include estimating a complexity to implement the at least oneidentified security control, and automatically implementing the at leastone identified security control in the software project responsive tothe estimated complexity satisfying a threshold complexity level. Step406 may also include providing guidance information related to theidentified security controls (such as, for example, code snippets and/orrelevant libraries).

Accordingly, the particular processing operations and otherfunctionality described in conjunction with the flow diagram of FIG. 4are presented by way of illustrative example only, and should not beconstrued as limiting the scope of the disclosure in any way. Forexample, the ordering of the process steps may be varied in otherembodiments, or certain steps may be performed concurrently with oneanother rather than serially.

The above-described illustrative embodiments provide significantadvantages relative to conventional approaches. For example, someembodiments are configured to filter security controls based on targetmarkets and/or assurance levels. Additionally, some embodiments provideautomated means for implementing such security controls in a softwareproject. These and other embodiments can effectively improve the overallsecurity of the system, ensure certain software complies with relevantprivacy/security standards, and improve the efficiency of implementingsecurity planning process. Additionally, different security scopes canbe modeled to balance time to market versus target security levelsconsiderations. Security analysis paralysis may also be avoided byprioritizing the requirements into assurance levels and by providing amechanism to filter based on target market. Additionally, someembodiments are configured to provide a security dashboard that isupdated over time in order to manage, for example, changes and/oradditions to the design of software project (such as, for example, toarchitectures, suppliers, etc.), changes to security standards, and/ornew standards.

It is to be appreciated that the particular advantages described aboveand elsewhere herein are associated with particular illustrativeembodiments and need not be present in other embodiments. Also, theparticular types of information processing system features andfunctionality as illustrated in the drawings and described above areexemplary only, and numerous other arrangements may be used in otherembodiments.

As mentioned previously, at least portions of the information processingsystem 100 can be implemented using one or more processing platforms. Agiven such processing platform comprises at least one processing devicecomprising a processor coupled to a memory. The processor and memory insome embodiments comprise respective processor and memory elements of avirtual machine or container provided using one or more underlyingphysical machines. The term “processing device” as used herein isintended to be broadly construed so as to encompass a wide variety ofdifferent arrangements of physical processors, memories and other devicecomponents as well as virtual instances of such components. For example,a “processing device” in some embodiments can comprise or be executedacross one or more virtual processors. Processing devices can thereforebe physical or virtual and can be executed across one or more physicalor virtual processors. It should also be noted that a given virtualdevice can be mapped to a portion of a physical one.

Some illustrative embodiments of a processing platform used to implementat least a portion of an information processing system comprises cloudinfrastructure including virtual machines implemented using a hypervisorthat runs on physical infrastructure. The cloud infrastructure furthercomprises sets of applications running on respective ones of the virtualmachines under the control of the hypervisor. It is also possible to usemultiple hypervisors each providing a set of virtual machines using atleast one underlying physical machine. Different sets of virtualmachines provided by one or more hypervisors may be utilized inconfiguring multiple instances of various components of the system.

These and other types of cloud infrastructure can be used to providewhat is also referred to herein as a multi-tenant environment. One ormore system components, or portions thereof, are illustrativelyimplemented for use by tenants of such a multi-tenant environment.

As mentioned previously, cloud infrastructure as disclosed herein caninclude cloud-based systems such as Amazon Web Services (AWS), GoogleCloud Platform (GCP) and Microsoft Azure. Virtual machines provided insuch systems can be used to implement at least portions of one or moreof a computer system and a content addressable storage system inillustrative embodiments. These and other cloud-based systems inillustrative embodiments can include object stores such as Amazon S3,GCP Cloud Storage, and Microsoft Azure Blob Storage.

In some embodiments, the cloud infrastructure additionally oralternatively comprises a plurality of containers implemented usingcontainer host devices. For example, as detailed herein, a givencontainer of cloud infrastructure illustratively comprises a Dockercontainer or other type of Linux Container (LXC). The containers are runon virtual machines in a multi-tenant environment, although otherarrangements are possible. The containers are utilized to implement avariety of different types of functionality within the system 100. Forexample, containers can be used to implement respective processingdevices providing compute and/or storage services of a cloud-basedsystem. Again, containers may be used in combination with othervirtualization infrastructure such as virtual machines implemented usinga hypervisor.

Illustrative embodiments of processing platforms will now be describedin greater detail with reference to FIGS. 5 and 6. Although described inthe context of system 100, these platforms may also be used to implementat least portions of other information processing systems in otherembodiments.

FIG. 5 shows an example processing platform comprising cloudinfrastructure 500. The cloud infrastructure 500 comprises a combinationof physical and virtual processing resources that are utilized toimplement at least a portion of the information processing system 100.The cloud infrastructure 500 comprises multiple virtual machines (VMs)and/or container sets 502-1, 502-2, . . . 502-L implemented usingvirtualization infrastructure 504. The virtualization infrastructure 504runs on physical infrastructure 505, and illustratively comprises one ormore hypervisors and/or operating system level virtualizationinfrastructure. The operating system level virtualization infrastructureillustratively comprises kernel control groups of a Linux operatingsystem or other type of operating system.

The cloud infrastructure 500 further comprises sets of applications510-1, 510-2, . . . 510-L running on respective ones of theVMs/container sets 502-1, 502-2, . . . 502-L under the control of thevirtualization infrastructure 504. The VMs/container sets 502 compriserespective VMs, respective sets of one or more containers, or respectivesets of one or more containers running in VMs. In some implementationsof the FIG. 5 embodiment, the VMs/container sets 502 comprise respectiveVMs implemented using virtualization infrastructure 504 that comprisesat least one hypervisor.

An example of a hypervisor platform used to implement a hypervisorwithin the virtualization infrastructure 504 is the VMware® vSphere®which has an associated virtual infrastructure management system such asthe VMware® vCenter™. The underlying physical machines comprise one ormore distributed processing platforms that include one or more storagesystems.

In other implementations of the FIG. 5 embodiment, the VMs/containersets 502 comprise respective containers implemented using virtualizationinfrastructure 504 that provides operating system level virtualizationfunctionality, such as support for Docker containers running on baremetal hosts, or Docker containers running on VMs. The containers areillustratively implemented using respective kernel control groups of theoperating system.

As is apparent from the above, one or more of the processing modules orother components of system 100 may each run on a computer, server,storage device or other processing platform element. A given suchelement is viewed as an example of what is more generally referred toherein as a “processing device.” The cloud infrastructure 500 shown inFIG. 5 may represent at least a portion of one processing platform.Another example of such a processing platform is processing platform 600shown in FIG. 6.

The processing platform 600 in this embodiment comprises a portion ofsystem 100 and includes a plurality of processing devices, denoted602-1, 602-2, 602-3, . . . 602-K, which communicate with one anotherover a network 604.

The network 604 comprises any type of network, including by way ofexample a global computer network such as the Internet, a WAN, a LAN, asatellite network, a telephone or cable network, a cellular network, awireless network such as a Wi-Fi or WiMAX network, or various portionsor combinations of these and other types of networks.

The processing device 602-1 in the processing platform 600 comprises aprocessor 610 coupled to a memory 612.

The processor 610 comprises a microprocessor, a microcontroller, anASIC, a FPGA or other type of processing circuitry, as well as portionsor combinations of such circuitry elements.

The memory 612 comprises RAM, ROM or other types of memory, in anycombination. The memory 612 and other memories disclosed herein shouldbe viewed as illustrative examples of what are more generally referredto as “processor-readable storage media” storing executable program codeof one or more software programs.

Articles of manufacture comprising such processor-readable storage mediaare considered illustrative embodiments. A given such article ofmanufacture comprises, for example, a storage array, a storage disk oran integrated circuit containing RAM, ROM or other electronic memory, orany of a wide variety of other types of computer program products. Theterm “article of manufacture” as used herein should be understood toexclude transitory, propagating signals. Numerous other types ofcomputer program products comprising processor-readable storage mediacan be used.

Also included in the processing device 602-1 is network interfacecircuitry 614, which is used to interface the processing device with thenetwork 604 and other system components, and may comprise conventionaltransceivers.

The other processing devices 602 of the processing platform 600 areassumed to be configured in a manner similar to that shown forprocessing device 602-1 in the figure.

Again, the particular processing platform 600 shown in the figure ispresented by way of example only, and system 100 may include additionalor alternative processing platforms, as well as numerous distinctprocessing platforms in any combination, with each such platformcomprising one or more computers, servers, storage devices or otherprocessing devices.

For example, other processing platforms used to implement illustrativeembodiments can comprise different types of virtualizationinfrastructure, in place of or in addition to virtualizationinfrastructure comprising virtual machines. Such virtualizationinfrastructure illustratively includes container-based virtualizationinfrastructure configured to provide Docker containers or other types ofLXCs.

As another example, portions of a given processing platform in someembodiments can comprise converged infrastructure such as VxRail™,VxRack™, VxBlock™, or Vblock® converged infrastructure commerciallyavailable from VCE, the Virtual Computing Environment Company, now theConverged Platform and Solutions Division of Dell EMC.

It should therefore be understood that in other embodiments differentarrangements of additional or alternative elements may be used. At leasta subset of these elements may be collectively implemented on a commonprocessing platform, or each such element may be implemented on aseparate processing platform.

Also, numerous other arrangements of computers, servers, storageproducts or devices, or other components are possible in the informationprocessing system 100. Such components can communicate with otherelements of the information processing system 100 over any type ofnetwork or other communication media.

For example, particular types of storage products that can be used inimplementing a given storage system of a distributed processing systemin an illustrative embodiment include VNX® and Symmetrix VMAX® storagearrays, software-defined storage products such as ScaleIO™ and ViPR®,all-flash and hybrid flash storage arrays such as Unity™, cloud storageproducts such as Elastic Cloud Storage (ECS), object-based storageproducts such as Atmos®, scale-out all-flash storage arrays such asXtremIO™, and scale-out NAS clusters comprising Isilon® platform nodesand associated accelerators, all from Dell EMC. Combinations of multipleones of these and other storage products can also be used inimplementing a given storage system in an illustrative embodiment.

It should again be emphasized that the above-described embodiments arepresented for purposes of illustration only. Many variations and otheralternative embodiments may be used. Also, the particular configurationsof system and device elements and associated processing operationsillustratively shown in the drawings can be varied in other embodiments.Thus, for example, the particular types of processing platforms,modules, cloud-based systems and virtual resources deployed in a givenembodiment and their respective configurations may be varied. Moreover,the various assumptions made above in the course of describing theillustrative embodiments should also be viewed as exemplary rather thanas requirements or limitations of the disclosure. Numerous otheralternative embodiments within the scope of the appended claims will bereadily apparent to those skilled in the art.

1. A computer-implemented method comprising: maintaining a databasecomprising mappings between (i) a plurality of security controls and(ii) security requirements related to a plurality of security standards,wherein said maintaining is based at least in a part on a softwarescript that identifies overlapping sections of the plurality of securitystandards; obtaining information pertaining to a software project and atarget market of the software project; identifying, based on theobtained information, one or more of the security controls in thedatabase to be implemented in the software project in order to satisfyat least a threshold level of security defined for the software project,wherein the threshold level of security is based at least in part on oneor more of the plurality of security standards related to the targetmarket; and automatically implementing at least one of the identifiedsecurity controls in the software project; wherein the method isperformed by at least one processing device comprising a processorcoupled to a memory.
 2. The computer-implemented method of claim 1,wherein the obtained information corresponds to user input provided inresponse to one or more application profiling questions provided on agraphical user interface.
 3. The computer-implemented method of claim 1,wherein the obtained information comprises a software designrepresentation of the software project that indicates at least one of:one or more processes of the software project, one or more dataflowswithin the software project, a type of each of the dataflows, one ormore existing security controls, and one or more storage data locations.4. The computer-implemented method of claim 1, wherein the database mapsat least one of the security controls to multiple ones of the securitystandards to remove overlapping security requirements defined in theplurality of security standards.
 5. The computer-implemented method ofclaim 1, comprising: maintaining one or more application criteria foreach of the plurality of security controls, wherein the applicationcriteria defines software characteristics that trigger a correspondingone of the security controls and a context in which the correspondingsecurity control is required.
 6. The computer-implemented method ofclaim 5, wherein the identifying the one or more security controls isbased at least in part on the application criteria maintained for eachof the plurality of security controls.
 7. The computer-implementedmethod of claim 1, comprising: maintaining, for a given one of thesecurity controls, a plurality of verification methods, wherein theverification methods verify whether the given security control satisfiesdifferent levels of security defined for the software project; andproviding information indicative of the identified one or more securitycontrols and at least one verification method corresponding to at leastone of the identified security control that corresponds to the thresholdlevel of security defined for the software project.
 8. Thecomputer-implemented method of claim 7, wherein the threshold level ofsecurity is configurable based on user input.
 9. Thecomputer-implemented method of claim 7, wherein the plurality ofverification methods for the given security control comprises one ormore of: a self-attestation method; an automated static analysis method;and an expert-verification method.
 10. The computer-implemented methodof claim 1, comprising: obtaining user input specifying a change to oneor more of the target market and the threshold level for the softwareproject; and dynamically updating the identified one or more securitycontrols based on the change.
 11. The computer-implemented method ofclaim 1, comprising: estimating a complexity to implement the at leastone identified security control, wherein the at least one identifiedsecurity control is automatically implemented in the software projectresponsive to the estimated complexity satisfying a threshold complexitylevel.
 12. A computer program product comprising a non-transitoryprocessor-readable storage medium having stored therein program code ofone or more software programs, wherein the program code when executed byat least one processing device causes the at least one processingdevice: to maintain a database comprising mappings between (i) aplurality of security controls and (ii) security requirements related toa plurality of security standards, wherein said maintaining is based atleast in a part on a software script that identifies overlappingsections of the plurality of security standards; to obtain informationpertaining to a software project and a target market of the softwareproject; to identify, based on the obtained information, one or more ofthe security controls in the database to be implemented in the softwareproject in order to satisfy at least a threshold level of securitydefined for the software project, wherein the threshold level ofsecurity is based at least in part on one or more of the plurality ofsecurity standards related to the target market, and to automaticallyimplement at least one of the identified security controls in thesoftware project.
 13. The computer program product of claim 12, whereinthe obtained information corresponds to user input provided in responseto one or more application profiling questions provided on a graphicaluser interface.
 14. The computer program product of claim 12, whereinthe obtained information comprises a software design representation ofthe software project that indicates at least one of: one or moreprocesses of the software project, one or more dataflows within thesoftware project, a type of each of the dataflows, one or more existingsecurity controls, and one or more storage data locations.
 15. Thecomputer program product of claim 12, wherein the database maps at leastone of the security controls to multiple ones of the security standardsto remove overlapping security requirements defined in the plurality ofsecurity standards.
 16. The computer program product of claim 12,wherein the program code when executed by the at least one processingdevice causes the at least one processing device: to maintain one ormore application criteria for each of the plurality of securitycontrols, wherein the application criteria defines softwarecharacteristics that trigger a corresponding one of the securitycontrols and a context in which the corresponding security control isrequired, wherein the identifying the at least one security control isbased at least in part on the application criteria that is maintainedfor each of the plurality of security controls.
 17. An apparatuscomprising: at least one processing device comprising a processorcoupled to a memory; the at least one processing device beingconfigured: to maintain a database comprising mappings between (i) aplurality of security controls and (ii) security requirements related toa plurality of security standards, wherein said maintaining is based atleast in a part on a software script that identifies overlappingsections of the plurality of security standards; to obtain informationpertaining to a software project and a target market of the softwareproject; to identify, based on the obtained information, one or more ofthe security controls in the database to be implemented in the softwareproject in order to satisfy at least a threshold level of securitydefined for the software project, wherein the threshold level ofsecurity is based at least in part on one or more of the plurality ofsecurity standards related to the target market, and to automaticallyimplement at least one of the identified security controls in thesoftware project.
 18. The system of claim 17, wherein at least one of:the obtained information corresponds to user input provided in responseto one or more application profiling questions provide on a graphicaluser interface; and the obtained information comprises a software designrepresentation of the software project that indicates at least one of:one or more processes of the software project, one or more dataflowswithin the software project, a type of each of the dataflows, one ormore existing security controls, and one or more storage data locations.19. (canceled)
 20. The system of claim 17, wherein the at least oneprocessing device is configured: to obtain user input specifying achange to one or more of the target market and the threshold level forthe software project; and to update the identified one or more securitycontrols based on the change.
 21. The method of claim 1, wherein saidobtaining comprises: determining the target market of the softwareproject by identifying one or more portions of software code associatedwith the software project that correspond to one or more of theplurality of security standards.